Malware analysis continuation system and malware analysis continuation method

The present invention relates to a malware analysis continuation system and a malware analysis continuation method.

There is dynamic analysis that actually runs malware, records a behavior of the malware, and performs analysis. This analysis method is widely used because it can be executed semi-automatically and can perform analysis efficiently. In addition, there is static analysis that deciphers codes of malware to manifest the behavior of the malware. However, this analysis method requires time and expertise. Therefore, the dynamic analysis tends to be more widely used.

On the other hand, in the dynamic analysis of the malware, the malware needs to actually run. Therefore, in a case where there are external dependencies, for example, the malware runs while communicating with an attacker server including a command & control (C2) server, when the condition is not satisfied, for example, when the attack has already been ended and the server of the attacker is no longer in operation, which makes it impossible to perform communication, as in this example, it is difficult to continue the analysis. Techniques related to this are disclosed in JP 2018-169792 A, JP 2022-125123 A, Zhaoyan Xu, Antonio Nappa, Robert Baykov, Guangliang Yang, Juan Caballero, Guofei Gu: AUTOPROBE: Towards Automatic Active Malicious Server Probing Using Dynamic Binary Analysis, 21st ACM Conference on Computer and Communications Security (CCS'14), pp. 179 to 190 (2014), and Takahiro Shimakawa, Masahiro Kuyama, Makoto Sato, Toshio Nawa, Hiroki Takakura, Ryoichi Sasaki: Development of intellectual network forensic system LIFT against targeted attack—Analysis of malware using dummy C&C Servers—, Multimedia, Distributed, Cooperative, and Mobile (DICOMO2016) Symposium, pp. 1087 to 1092 (2016).

In the dynamic analysis of malware, the malware needs to actually run. Therefore, in a case where there are external dependencies, for example, the malware runs while communicating with the attacker server, when the condition is not satisfied, for example, when the attack has already been ended and the server of the attacker is no longer in operation, which makes it impossible to perform communication, as in this example, it is difficult to continue the analysis.

In JP 2018-169792 A or JP 2022-125123 A, when communication by malware occurs, the communication is temporarily suspended, static analysis of the malware is performed, and then a response expected by the malware is made on the basis of the results of the static analysis to induce a process.

However, the static analysis of malware requires advanced skills and time. In addition, it is not easy to appropriately create communication expected by the malware on the basis of the results of the static analysis.

Zhaoyan Xu, Antonio Nappa, Robert Baykov, Guangliang Yang, Juan Caballero, Guofei Gu: AUTOPROBE: Towards Automatic Active Malicious Server Probing Using Dynamic Binary Analysis, 21st ACM Conference on Computer and Communications Security (CCS'14), pp. 179 to 190 (2014) discloses a technique that forcibly executes a process related to a response from C2 using symbolic execution, fuzzing, register rewriting, and the like and searches for an execution path depending on the response from C2.

However, the execution path is randomly detected due to the characteristics of the fuzzing and the like. Further, the object of this technique is not to continue dynamic analysis, but is to create a fingerprint of a C2 server.

Takahiro Shimakawa, Masahiro Kuyama, Makoto Sato, Toshio Nawa, Hiroki Takakura, Ryoichi Sasaki: Development of intellectual NEtwork forensic system LIFT against targeted attack—Analysis of malware using dummy C&C Servers—, Multimedia, Distributed, Cooperative, and Mobile (DICOMO2016) Symposium, pp. 1087 to 1092 (2016) discloses a technique that prepares a blockage analysis environment and an environment for C2 communication connected to the Internet, communicates with a destination detected in a blockage environment from the environment for C2 communication to acquire a file, and transmits the file to the blockage environment, thereby performing dynamic analysis of malware even in the blockage environment, that is, even in a state in which C2 is substantially not in operation.

However, this technology has restrictions, such as focusing only on files and the need for the C2 server to be alive at the time of analysis.

As described above, there are some techniques that attempt dynamic analysis even in a state in which the C2 server is not operating actually or in a pseudo manner. However, these techniques have problems, such as the need to perform static analysis separately and the need for the C2 server to be in operation.

An object of the present invention is to provide a malware analysis continuation system that continues analysis of malware even in a case where an attacker server is not in operation and it is difficult to perform communication.

According to an aspect of the present invention, there is provided a malware analysis continuation system connected to the Internet. The malware analysis continuation system includes: a communication destination observation unit observing communication with an attacker server and accumulating a response to the communication as past data; a dynamic analysis unit performing dynamic analysis of malware; a communication mediation unit mediating communication of the dynamically analyzed malware and performing control such that the response accumulated as the past data is returned to continue the dynamic analysis even in a case where the communication with the attacker server is stopped; a similar communication extraction unit extracting past communication similar to communication generated by the malware as similar communication from the past data; and a screen depiction unit depicting information related to the malware on a screen.

According to an aspect of the present invention, the malware analysis continuation system can continue analysis of malware even in a case where an attacker server is not in operation and it is difficult to perform communication.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the present invention is not interpreted as being limited to the content of the embodiments described below. It will be easily understood by those skilled in the art that a specific configuration of the present invention can be modified without departing from the concept or gist of the present invention.

In the configurations of the invention that will be described below, the same or similar configurations or functions are denoted by the same reference numerals, and a duplicated description thereof will be omitted.

In this specification, the terms “first”, “second”, “third”, and the like are used to identify components and do not necessarily limit the number or order of components.

In some cases, the position, size, shape, range, and the like of each configuration illustrated in the drawings and the like do not indicate the actual position, size, shape, range, and the like in order to facilitate understanding of the invention. Therefore, the present invention is not limited to the position, size, shape, range, and the like disclosed in the drawings and the like.

Embodiment 1 shows a process of a malware analysis continuation system by attack communication substitution in a case where a result of separate observation is returned as a substitute for attack communication, such as command control (C2) communication, to a malware sample to continue or manifest the original operation, thereby automatically continuing and inducing a behavior of malware.

1 FIG. 101 116 118 117 1100 118 is a diagram illustrating an example of a configuration of a malware analysis continuation system by attack communication substitution according to an embodiment of the present invention. A malware analysis continuation systemby attack communication substitution according to the embodiment connects a user terminaloperated by a user and the Internetvia a network. An attacker serveris connected to the Internet.

101 103 104 103 105 102 106 107 107 The malware analysis continuation systemby attack communication substitution is a computer including a central processing unit (CPU), a main memoryfor storing data necessary for the CPUto execute processes, a storage device, such as a hard disk or a flash memory, having the capacity to store a large amount of data, an interface (IF)for communicating with other devices, an input/output device, such as a keyboard or a display, for inputting and outputting data, and a communication pathconnecting these devices. In addition, the communication pathis, for example, an information transmission medium such as a bus or a cable.

103 108 104 103 109 104 The CPUexecutes a communication destination observation programstored in the main memoryto configure a communication destination observation unit and observes the attacker server. Further, the CPUexecutes a dynamic analysis programstored in the main memoryto configure a dynamic analysis unit and performs dynamic analysis of the malware to be analyzed.

103 110 104 103 111 104 113 Furthermore, the CPUexecutes a communication mediation programstored in the main memoryto configure a communication mediation unit and mediates communication occurring during the dynamic analysis. Moreover, the CPUexecutes a similar communication extraction programstored in the main memoryto configure a similar communication extraction unit and extracts communication similar to the target communication from a communication list.

103 112 104 In addition, the CPUexecutes a screen depiction programstored in the main memoryto configure a screen depiction unit and presents various results through a screen.

105 113 114 115 The storage devicestores the communication listthat manages information of communication destinations, a response storage areathat stores responses acquired from the communication destinations, and a dynamic analysis result storage area listthat stores the results of the dynamic analysis of the malware.

104 105 106 102 Each of the above-described programs and data may be stored in advance in the memoryor the storage deviceor may be installed (loaded) from the input/output deviceor from other devices via the IFwhen needed.

1 FIG. Further, the configuration of the malware analysis continuation system by attack communication substitution described with reference tois only an example, and the present invention is not limited thereto.

2 FIG. 113 113 108 is a diagram illustrating an example of the communication list. The communication listis past data created by the communication destination observation program (communication destination observation unit).

2 FIG. 1 FIG. 113 201 202 203 204 205 206 114 As illustrated in, the communication listis configured to include, for example, a communication ID, a registration date and time, a URL, a sample family name, a request, and a response(stored in the response storage areaillustrated in).

201 201 The communication IDis a field that stores for uniquely identifying the identification information communication destination to be observed. In Embodiment 1, a number is stored as the identification information in the communication ID.

202 201 202 The registration date and timeindicates the date and time when the communication destination was registered in the system. For example, a communication destination corresponding to an entry with a communication IDof “0” was registered at 00:00:00 on Jan. 1, 2024. The present invention is not limited to the data format of the time stored in the registration date and time. Any data format, such as Unixtime, may be used as long as the data format can determine the time.

203 201 The URLis a field that stores the URL of the communication destination to be observed. For example, the URL name of the communication destination corresponding to the entry with the communication IDof “0” is “example.com.hoge”.

204 201 The sample family nameis a field that stores the family name of the malware associated with the communication destination to be observed. For example, the family name of the malware associated with the communication destination corresponding to the entry with the communication IDof “0” is “family A”.

205 201 The requestis a field that stores the content of a request when the communication destination to be observed is observed. For example, a request when the communication destination corresponding to the entry with the communication IDof “0” is observed is composed of “GET/hoge HTTP/1.0”, “User-Agent: hoge”, or the like.

206 201 The responseis a field that stores the content of a response obtained from the communication destination to be observed. For example, a response obtained when the communication destination corresponding to the entry with the communication IDof “0” is observed is composed of “status: 200”, “date: Mon, 1 Jan. 2024”, or the like.

2 FIG. In addition, the communication list described with reference tois only an example, and the present invention is not limited thereto.

101 Next, a process executed by the malware analysis continuation systemwill be described.

101 109 The malware analysis continuation systemby attack communication substitution observes the communication destination of an attacker and accumulates observation results, separately from a malware dynamic analysis process centered on the dynamic analysis program.

3 FIG. 101 is a flowchart illustrating an example of a communication destination observation process executed by the malware analysis continuation systemaccording to Embodiment 1.

108 103 When receiving an execution instruction, the communication destination observation programexecuted by the CPUstarts the process described below.

108 301 The communication destination observation program (communication destination observation unit)acquires information of the communication destination to be observed (Step). For example, the information is acquired from a security vendor's website or a commercial service that shares information of the communication destination exploited by the attacker.

108 301 302 Then, the communication destination observation programobserves the communication destination to be observed which has been acquired in Step(Step).

108 302 113 114 303 Then, the communication destination observation programstores the observation results of the communication destination obtained in Stepin the communication listand the response storage areaand ends the process (Step).

3 FIG. In addition, a method for observing the communication destination described with reference tois only an example, and the present invention is not limited thereto.

For example, there is a case where not only attack communication but also non-attack communication is returned to the same communication destination, according to the time or the access source. Therefore, for example, an advanced technique may be contrived that determines whether or not the communication is attack communication on the basis of the content of the communication and accumulates only the communication that seems to be attack communication.

In addition, various types of observation systems may be prepared to observe the communication destination in order to obtain attack communication. For example, an advanced technique may be contrived that prepares a plurality of types of guardware, such as virtual machines, physical machines, and clouds, as guardware, prepares a plurality of operating systems (OSs), browsers, and the like as software, selects communication that seems to be attack communication from a plurality of types of communication, and stores the selected communication.

4 FIG. 101 is a flowchart illustrating an outline of a main process executed by the malware analysis continuation systemaccording to Embodiment 1.

101 401 5 FIG. First, the malware analysis continuation systemperforms dynamic analysis (Step). Details thereof will be described with reference to.

402 6 FIG. Then, in a case where communication occurs during the dynamic analysis, the communication is mediated (Step). Details thereof will be described with reference to.

113 403 7 FIG. Then, for the mediated communication, similar communication is extracted from the communication list(Step). Details thereof will be described with reference to.

402 403 404 The processes in Stepsandare executed until the dynamic analysis is ended. When the dynamic analysis is ended, the entire flow of the process is also ended (Step).

4 FIG. In addition, the processing flow of the malware analysis continuation system described with reference tois only an example, and the present invention is not limited thereto.

5 FIG. 101 is a flowchart illustrating an example of a dynamic analysis process executed by the malware analysis continuation systemaccording to Embodiment 1.

109 103 When receiving an execution instruction, the dynamic analysis program (dynamic analysis unit)executed by the CPUstarts the process described below.

109 501 The dynamic analysis programreceives malware to be analyzed from a user (Step).

109 501 502 109 Then, the dynamic analysis programperforms dynamic analysis of the malware received in Step(Step). For example, the dynamic analysis programactually runs the malware for a predetermined period of time to obtain information of the connection destination, running process, generated files, and the like of the malware.

109 502 115 503 Then, the dynamic analysis programstores the results of the dynamic analysis of the malware obtained in Stepin the analysis result storage areaand ends the process (Step).

5 FIG. 109 Further, the dynamic analysis processing method described with reference tois only an example, and the present invention is not limited thereto. In addition, the results of the dynamic analysis of the malware may be acquired from a source other than the dynamic analysis programand recorded. For example, the results of the dynamic analysis may be acquired from an external malware analysis continuation system or malware analysis service.

6 FIG. 101 is a flowchart illustrating an example of a communication mediation process executed by the malware analysis continuation systemaccording to Embodiment 1.

110 103 When receiving an execution instruction, the communication mediation program(communication mediation unit) executed by the CPUstarts the process described below.

110 601 The communication mediation programis triggered by the occurrence of communication during the dynamic analysis and mediates the communication of the malware (Step).

110 601 602 110 Then, the communication mediation programchecks the state of the communication destination of the communication that has been mediated in Stepand temporarily suspended (Step). Specifically, the communication mediation programchecks an operating state of the communication destination.

110 603 604 605 Then, the communication mediation programchecks whether or not the communication destination is in operation (Step). In a case where the communication destination is in operation, the process proceeds to Step. In a case where the communication destination is not in operation, the process proceeds to Step.

110 601 604 The communication mediation programresumes the communication that has been mediated in Stepand temporarily suspended and ends the process (Step).

110 113 605 606 607 The communication mediation programchecks whether or not the communication destination was observed in the past with reference to the communication list(Step). In a case where the communication destination was observed, the process proceeds to Step. In a case where the communication destination was not observed, the process proceeds to Step.

110 601 606 The communication mediation programreturns, as a response, the results of the observation for the communication that has been mediated in Stepand temporarily suspended and ends the process (Step).

110 607 7 FIG. The communication mediation programextracts communication similar to the communication (Step). Details thereof will be described with reference to.

110 607 601 608 The communication mediation programreturns, as a response, the result of the communication extracted in Stepfor the communication that has been mediated in Stepand temporarily suspended and ends the process (Step).

6 FIG. In addition, the communication mediation processing method described with reference tois only an example, and the present invention is not limited thereto.

For example, as described above, there is a case where not only attack communication but also non-attack communication is returned to the same communication destination, according to the time or the access source. Therefore, for example, an advanced technique may be contrived that, in a case where a response that does not seem to be attack communication is returned from the communication destination even though the communication destination is in operation, returns the accumulated attack communication instead of the response.

Further, alternative responses or simulations may be made not only for the content of the communication but also for other matters. For example, for DNMS, a past DNS in which the communication destination was in operation may be simulated to perform name resolution. Alternatively, name resolution may be performed for a specific environment such as an organization to be attacked.

Furthermore, there is malware that determines that, in a case where the response time is short, communication is not actually performed, but is performed locally and stops the operation. Therefore, the time actually required for communication may be simulated.

7 FIG. 101 is a flowchart illustrating an example of a similar communication extraction process executed by the malware analysis continuation systemaccording to Embodiment 1.

111 103 When receiving an execution instruction, the similar communication extraction program(similar communication extraction unit) executed by the CPUstarts the process described below.

111 110 701 The similar communication extraction programreceives information of the communication destination, from which similar communication is desired to be extracted, from the communication mediation program(Step).

111 701 113 702 111 Then, the similar communication extraction programextracts communication that is most similar to the communication destination received in Stepfrom the communication list(Step). For example, the similar communication extraction programextracts the similar communication using the similarities s of a sample family, a URL path, communication parameters, and the like.

111 702 114 703 Then, the similar communication extraction programacquires a response to the similar communication extracted in Stepfrom the response storage area(Step).

111 702 703 704 Then, the similar communication extraction programreturns the similar communication acquired in Stepand the response to the communication acquired in Stepand ends the process (Step).

7 FIG. In addition, the similar communication extraction processing method described with reference tois only an example, and the present invention is not limited thereto.

101 4 FIG. The malware analysis continuation systemexecutes a screen depiction process for displaying various types of information to the user, separately from the process described with reference to.

8 FIG. 101 is a flowchart illustrating an example of a screen depiction process executed by malware analysis continuation systemaccording to Embodiment 1.

112 103 When receiving an execution instruction, the screen depiction program (screen depiction unit)executed by the CPUstarts the process described below.

112 113 801 201 The screen depiction programacquires information related to the communication to be depicted from the communication list(Step). Here, it is assumed that a list including an entry composed of the communication IDis acquired.

112 113 802 201 The screen depiction programacquires information related to communication similar to the communication to be depicted from the communication list(Step). Here, it is assumed that a list including an entry composed of the communication IDis acquired.

112 803 The screen depiction programdepicts information related to the malware to be depicted on the screen (Step) and ends the process.

8 FIG. In addition, the screen depiction method described with reference tois only an example, and the present invention is not limited thereto.

9 FIG. 101 is an example of a malware analysis continuation system depiction screen generated by a program constituting the malware analysis continuation systemaccording to Embodiment 1.

9 FIG. 901 902 The screen illustrated inincludes a communication summaryand similar communication.

901 The communication summary (malicious website summary)is basic information related to the communication to be depicted. For example, the communication summary includes a communication ID, a registration date and time, a URL, a sample family name, a request, and a response.

902 902 The similar communicationis a list of communications similar to the communication to be depicted. For example, the similar communicationincludes a communication ID, a registration date and time, a URL, a sample family name, a request, a response, and a reason for similarity. Here, the reason for similarity may be, for example, that the URL is similar, that the sample family name is matched, that a portion of the request is similar, and that a portion of the response is matched.

As described above, the communication is displayed with a focus on the predicted lifetime of the communication. Therefore, the effect of supporting the creation of a watch list or a block list by the users including analysts is expected.

In addition, here, the depiction screen based on the execution results of each program according to Embodiment 1 is given as an example. However, this is only an example, and the present invention is not limited thereto. For example, any information related to the communication destination may be depicted in any format.

The dynamic analysis of malware is important in security work, but has the following problem. The malware needs to actually run. Therefore, in a case where there are external dependencies, for example, the malware runs while communicating with an attacker server including a C2 server, when the condition is not satisfied, it is difficult to continue the analysis.

101 According to Embodiment 1, the malware analysis continuation system,by attack communication substitution returns the result of separate observation as a substitute for attack communication, such as C2 communication, to the malware sample to continue or manifest the original operation, thereby automatically continuing and inducing the behavior of the malware.

Therefore, it is expected that the dynamic analysis of malware can be performed even in a situation in which it is difficult to continue the dynamic analysis of malware as in the related art, for example, even in a case where the communication destination is not in operation.

In addition, in Embodiment 1, the method of passively returning communication in response to the request from the malware sample has been described. However, Embodiment 1 is not limited thereto. For example, an advanced technique may be contrived that actively sends, to the malware sample, a response to communication similar to the request issued by the malware sample to actively induce the behavior of the malware sample.

Embodiment 2 shows a process of a malware analysis continuation system that enables the use of a support function from the outside via the network in addition to the support of on-premise malware dynamic analysis such that services can be provided via the cloud.

Hereinafter, Embodiment 2 will be described with a focus on the differences from Embodiment 1.

10 FIG. 1001 is a diagram illustrating an example of a configuration of a malware analysis continuation systemaccording to Embodiment 2 of the present invention. Since the configuration of the malware analysis continuation system according to Embodiment 2 is the same as that according to Embodiment 1, a description thereof will be omitted.

1019 1016 1019 1019 1018 A hardware configuration of the malware analysis continuation system according to Embodiment 2 differs from the hardware configuration according to Embodiment 1 in that it includes an external user terminal. In Embodiment 2, each program executes processes in response to a request from not only a user terminalwithin the network but also the external user terminaland returns the results of the processes to the external user terminalvia the Internet. This makes it possible to provide services via the cloud.

1008 1009 1010 1011 1012 Programs according to Embodiment 2 are the same as those according to Embodiment 1. In addition, processes executed by a communication destination observation program, a dynamic analysis program, a communication mediation program, a similar communication extraction program, and a screen depiction programaccording to Embodiment 2 are the same as those according to Embodiment 1. A data structure according to Embodiment 2 is the same as that according to Embodiment 1.

10 FIG. In addition, the configuration of the malware analysis continuation system according to Embodiment 2 described with reference tois only an example, and the present invention is not limited thereto.

1001 1018 According to Embodiment 2, the malware analysis continuation systemprovides an on-premise malware analysis support function to the internal user as in Embodiment 1 and also provides the same information to the external user via the Internet. This makes it possible to provide services via the cloud.

11 12 FIGS.and Finally, the problems of the malware analysis continuation system and a configuration for solving the problems will be described with reference to.

11 FIG. is a system diagram illustrating the problems of the malware analysis continuation system.

11 FIG. 1110 1200 1110 1300 116 1110 1110 As illustrated in, an attacker server (C2 server)performs, for example, the transmission of an attack command and the sending of additional files through malware. During an attack period (C2 enabled) for which the attacker serveris in operation, a user, who is an analyst, performs dynamic analysis using the user terminal. Specifically, a request is sent from the malware, and a response is sent from the attacker server. As described above, during the attack period (C2 enabled), it is possible to manifest the operation while communicating with the attacker serverand to perform dynamic analysis.

1110 1110 1110 1110 1300 116 1110 However, when a certain amount of time has passed since the start of the attack, the attacker destroys the attacker server(C2 ended). After an attack end period (C2 ended) for which the attacker serveris not in operation and is stopped, the request sent from the malware does not reach the attacker server, and no response is sent from the attacker server. As a result, the user, who is the analyst, is not able to perform dynamic analysis using the user terminal. As described above, since the attacker serveris stopped, there is no response, and the operation after communication is not manifested. As a result, it is not possible to perform dynamic analysis.

12 FIG. is a diagram illustrating the malware analysis continuation system according to the present invention that has solved the above-mentioned problems.

12 FIG. 1110 1300 116 1110 1110 As illustrated in, during the attack period (C2 enabled) for which the attacker serveris in operation, the user, who is an analyst, performs dynamic analysis using the user terminal. Specifically, a request is sent from the malware, and a response is sent from the attacker server. As described above, during the attack period (C2 enabled), it is possible to manifest the operation while communicating with the attacker serverand to perform dynamic analysis.

1110 1110 1110 1110 1300 116 However, when a certain amount of time has passed since the start of the attack, the attacker destroys the attacker server(C2 ended). After an attack end period (C2 termination) for which the attacker serveris not in operation and is stopped, the request sent from the malware does not reach the attacker server, and no response is sent from the attacker server. As a result, the user, who is the analyst, is not able to perform dynamic analysis using the user terminal.

101 101 101 101 101 1 FIG. Therefore, in the present invention, the request sent from the malware is transmitted to the malware analysis continuation systemillustrated in. The malware analysis continuation systemdetermines the URL. In a case where the URL is known, the malware analysis continuation systemreturns the accumulated response to the malware. In addition, the malware analysis continuation systemdetermines the URL. In a case where the URL is unknown, the malware analysis continuation systemextracts similar communication and returns the similar communication as a response to the malware.

As described above, in the present invention, the result of separate observation is returned as a substitute for attack communication, such as C2 communication, to the malware to continue or manifest the original operation.

According to the above-described embodiment, the result of separate observation is returned as a substitute for attack communication, such as C2 communication, to the malware sample to continue or manifest the original operation. This makes it possible to support the dynamic analysis of malware by automatically continuing and inducing the behavior of the malware.